CVE-2024-3400

Published Apr 12, 2024

Last updated 4 months ago

Overview

Description
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
Source
psirt@paloaltonetworks.com
NVD status
Analyzed
Products
pan-os

Risk scores

CVSS 3.1

Type
Primary
Base score
10
Impact score
6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity
CRITICAL

Known exploits

Data from CISA

Vulnerability name
Palo Alto Networks PAN-OS Command Injection Vulnerability
Exploit added on
Apr 12, 2024
Exploit action due
Apr 19, 2024
Required action
Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.

Weaknesses

psirt@paloaltonetworks.com
CWE-20
nvd@nist.gov
CWE-77

Social media

Hype score
Not currently trending
  1. Actively exploited CVE : CVE-2024-3400

    @transilienceai

    22 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  2. 🚨 Zero-Day in the Wild: Inside the PAN-#OS GlobalProtect Critical Command Injection (#CVE-2024-3400) https://t.co/eCFQe6sTqn Educational Purposes!

    @UndercodeUpdate

    5 Mar 2026

    28 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. Zero-Day Alert: Palo Alto CVE-2024-3400 (CVSS 10.0). Critical pre-auth RCE in GlobalProtect. Actively exploited. Attackers inject commands via HTTP requests to gain root. Patch immediately. Scan for exposed PAN-OS. https://t.co/eXmzbav3yy

    @computerauditor

    24 Feb 2026

    96 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. Heads up! Palo Alto CVE-2024-3400 is a perfect 10.0 RCE. Unauth attackers own PAN-OS GlobalProtect by injecting commands. If you're finding these unpatched, it's a critical bounty. Patch or hunt. https://t.co/iHN151wsSW

    @computerauditor

    17 Feb 2026

    63 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. تم رصد ثغرة يوم صفر في PAN-OS لدى Palo Alto Networks (CVE-2024-3400). تُمكّن من تنفيذ أوامر عن بُعد؛ وأدرجتها CISA في قائمة KEV مع مهلة إلزامية للتصحيح. #الأمن_السيبراني #ثغرات_يو

    @fyntralink

    16 Feb 2026

    42 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. Cytellite recent detection targeting CVE-2024-3400 — FOP Dmytro Nedilskyi Visit -- https://t.co/K4osjZ8kht #Loginsoft #Cytellite #Cybersecurity #CVE20243400 #LOVI #ThreatIntelligence #Infosecurity #AI https://t.co/U4yjXGLAaP

    @Loginsoft_Intel

    2 Jan 2026

    33 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. 🚨 The PAN-#OS Pandemic: How #CVE-2024-3400 Turns Your Firewall Into a Cybercriminal's Playground https://t.co/InDMBKGFFR Educational Purposes!

    @UndercodeUpdate

    30 Nov 2025

    36 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  8. 🚨 Plugin update: PaloAltoPlugin (CVE-2024-3400, CVE-2025-0133). PaloAlto PAN-OS XSS vulnerability detection added - GlobalProtect portal affected. Results: https://t.co/Iez2FOPZeB https://t.co/pO5FoKMDqJ

    @leak_ix

    19 Nov 2025

    331 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  9. Últimas noticias sobre #Hacking: En las últimas 24 horas, se destacaron tensiones regulatorias en comercio digital por bloqueos a LaLiga, ataques de ciberespionaje chinos a ONGs en EE.UU., explotación de la vulnerabilidad CVE-2024-3400 para minería... 👉 https://t.co/CAPEW

    @JaimeARestrepo_

    9 Nov 2025

    117 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  10. 🔥 PAN-OS GlobalProtect sigue vulnerable CVE-2024-3400 (CVSS 10.0) permite control total sin autenticación. Hay parches y firmas, pero miles de firewalls siguen expuestos. ¿Ya actualizaste? #Ciberseguridad #PaloAlto #PANOS #GlobalProtect #infosec https://t.co/YetYxMw7ck

    @trustlock_sec

    8 Oct 2025

    8 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  11. Surge in attacks targeting Palo Alto Networks' PAN-OS devices, exploiting vulnerabilities like CVE-2024-3400. Company urges immediate patching. Source: TechRadar #Cybersecurity

    @WhatsNext_Tech

    7 Oct 2025

    1 Impression

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  12. Ransomware surges, Russian hybrid warfare drones, major leaks, and AI-powered scams dominate cyber headlines this hour 🚨 🛡️ Massive exploitation of critical PAN-OS GlobalProtect flaw (CVE-2024-3400, CVSS 10.0) allowing root remote code execution on Palo Alto firewalls is

    @np_cyber_news

    3 Oct 2025

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  13. ⚠️ Weekly vuln radar from https://t.co/8RzyA4nEyg: CVE-2024-3400 (@stevenadair) CVE-2025-24132 CVE-2025-43300 CVE-2025-5777 CVE-2025-55177 CVE-2023-34044 (@pr0Ln) CVE-2023-20870 CVE-2025-10035 CVE-2025-20333 https://t.co/Z18UZ0WhOF

    @ptdbugs

    3 Oct 2025

    2 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  14. 🛡️ Increase in Scans for Palo Alto Global Protect Vulnerability (CVE-2024-3400), (Mon, Sep 29th) (SANS Internet Storm Center) ❓ How can you best mitigate risks from the CVE-2024-3400 vulnerability in Palo Alto's Global Protect software? Learn more at dilag3nt[.]com

    @Dilag3nt

    2 Oct 2025

    1 Impression

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  15. 🛡️ Increase in Scans for Palo Alto Global Protect Vulnerability (CVE-2024-3400), (Mon, Sep 29th) (SANS Internet Storm Center) ❓ What is the primary threat associated with CVE-2024-3400 in Palo Alto Networks' Global Protect? Learn more at dilag3nt[.]com

    @Dilag3nt

    2 Oct 2025

    1 Impression

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  16. 🚨 Hackers Actively Scanning to Exploit Palo Alto Networks PAN-OS Global Protect Vulnerability Read more: https://t.co/VtsR7zsUQK… A significant increase in internet-wide scans targeting the critical PAN-OS GlobalProtect vulnerability (CVE-2024-3400). Exploit attempts hav

    @sirjameshackz

    2 Oct 2025

    69 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  17. https://t.co/vWwhHpc0gB Increase in Scans for Palo Alto Global Protect Vulnerability (CVE-2024-3400)

    @samilaiho

    1 Oct 2025

    422 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  18. 🚨 Hackers Actively Scanning to Exploit Palo Alto Networks PAN-OS Global Protect Vulnerability Read more: https://t.co/ZYXvYxP5G1 A significant increase in internet-wide scans targeting the critical PAN-OS GlobalProtect vulnerability (CVE-2024-3400). Exploit attempts have h

    @The_Cyber_News

    1 Oct 2025

    14552 Impressions

    89 Retweets

    236 Likes

    75 Bookmarks

    3 Replies

    3 Quotes

  19. CRITICAL ALERT! A Zero-Day RCE Exploit Wave is actively hitting Palo Alto Networks GlobalProtect (CVE-2024-3400). Attackers are moving fast. If you run GlobalProtect, your network perimeter is compromised. Read the full report on - https://t.co/8y07evICHd https://t.co/IxaNRwIaBv

    @cyberbivash

    1 Oct 2025

    2 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  20. Explotación activa de vulnerabilidad crítica en PAN-OS GlobalProtect (CVE-2024-3400) Mas información: https://t.co/8t28bWgELL https://t.co/OJBwsTq0a3

    @CSIRT_Telconet

    30 Sept 2025

    115 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  21. IMMEDIATE SHUTDOWN! The critical Palo Alto PAN-OS Flaw (CVE-2024-3400) is under ACTIVE EXPLOITATION. We break down the threat and provide the mandatory Mitigation Steps required to stop the breach. Read the full report on - https://t.co/7sZC2vEs9d https://t.co/kexMmoWI5S

    @cyberbivash

    29 Sept 2025

    3 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  22. Increase in Scans for Palo Alto Global Protect Vulnerability (CVE-2024-3400), (Mon, Sep 29th) https://t.co/ajII9C0fWF #SANS #Cybersecurity https://t.co/fFWUqp1Nm3

    @PoseidonTPA

    29 Sept 2025

    19 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  23. Increase in Scans for Palo Alto Global Protect Vulnerability (CVE-2024-3400) https://t.co/FOnjZu31LP https://t.co/rPoHn2AbdM

    @sans_isc

    29 Sept 2025

    1400 Impressions

    0 Retweets

    3 Likes

    2 Bookmarks

    0 Replies

    0 Quotes

  24. Actively exploited CVE : CVE-2024-3400

    @transilienceai

    29 Sept 2025

    11 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  25. Actively exploited CVE : CVE-2024-3400

    @transilienceai

    28 Sept 2025

    6 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  26. Actively exploited CVE : CVE-2024-3400

    @transilienceai

    26 Sept 2025

    3 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  27. Actively exploited CVE : CVE-2024-3400

    @transilienceai

    25 Sept 2025

    5 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  28. Actively exploited CVE : CVE-2024-3400

    @transilienceai

    24 Sept 2025

    8 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  29. Actively exploited CVE : CVE-2024-3400

    @transilienceai

    23 Sept 2025

    5 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  30. Actively exploited CVE : CVE-2024-3400

    @transilienceai

    19 Sept 2025

    17 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  31. Salt Typhoon hid inside U.S. Army National Guard networks for 9 months. No malware. No alerts. Just broken fundamentals. Here are 5 urgent lessons every organization must act on to avoid being next👇 1️⃣ Don’t wait for 0-days. Patch known CVEs CVE-2024-3400 and CVE-20

    @HunterStrategy

    15 Sept 2025

    89 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  32. CVE-2024-3400 Palo Alto Networks PAN-OS命令注入漏洞 5月12日的是看到 paloaltonetworks 有一个安全公告[1], CVE编号是 CVE-2024-3400, 漏洞是一个命令注入,影响的版本 技术联系:https://t.co/9tTNUWam4h https://t.co/rxy44TfeUB

    @TTUinnn1

    11 Sept 2025

    4120 Impressions

    0 Retweets

    53 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  33. CVE-2024-3400 Palo Alto Networks PAN-OS命令注入漏洞 5月12日的是看到 paloaltonetworks 有一个安全公告[1], CVE编号是 CVE-2024-3400, 漏洞是一个命令注入,影响的版本 https://t.co/HmWGk77OHd https://t.co/KV4ORFludU

    @Gerva555

    1 Sept 2025

    2224 Impressions

    0 Retweets

    33 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  34. Actively exploited CVE : CVE-2024-3400

    @transilienceai

    27 Jul 2025

    68 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  35. Actively exploited CVE : CVE-2024-3400

    @transilienceai

    8 May 2025

    6 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  36. Actively exploited CVE : CVE-2024-3400

    @transilienceai

    7 May 2025

    7 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  37. Actively exploited CVE : CVE-2024-3400

    @transilienceai

    6 May 2025

    6 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  38. Actively exploited CVE : CVE-2024-3400

    @transilienceai

    5 May 2025

    3 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  39. Actively exploited CVE : CVE-2024-3400

    @transilienceai

    4 May 2025

    8 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  40. Actively exploited CVE : CVE-2024-3400

    @transilienceai

    30 Apr 2025

    8 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  41. Actively exploited CVE : CVE-2024-3400

    @transilienceai

    28 Apr 2025

    6 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  42. Actively exploited CVE : CVE-2024-3400

    @transilienceai

    27 Apr 2025

    9 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  43. Actively exploited CVE : CVE-2024-3400

    @transilienceai

    26 Apr 2025

    22 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  44. Actively exploited CVE : CVE-2024-3400

    @transilienceai

    26 Apr 2025

    26 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  45. Actively exploited CVE : CVE-2024-3400

    @transilienceai

    25 Apr 2025

    15 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  46. Actively exploited CVE : CVE-2024-3400

    @transilienceai

    25 Apr 2025

    30 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  47. Actively exploited CVE : CVE-2024-3400

    @transilienceai

    23 Apr 2025

    19 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  48. +24,000 IPs Target PAN-OS Global Protect Gateways Researchers have observed nearly 24,000 IP addresses probing for vulnerable Palo Alto Networks PAN-OS devices following disclosure of a zero-day (CVE-2024-3400). The flaw allows unauthenticated command execution via the

    @WarrenTevora

    7 Apr 2025

    24 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  49. Researchers have observed nearly 24,000 IP addresses probing for vulnerable Palo Alto Networks PAN-OS devices following disclosure of a zero-day (CVE-2024-3400). The flaw allows unauthenticated command execution via the GlobalProtect portal, potentially exposing internal systems.

    @WarrenTevora

    7 Apr 2025

    2 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  50. Mass scanning alert: 24,000+ IPs targeting Palo Alto GlobalProtect (PAN-OS) VPNs in coordinated login attempts. Likely probing for CVE-2024-3400 exploits. Defenders: check auth logs NOW. Details: https://t.co/eiRJ8LSpVB #CyberSecurity #ThreatIntel

    @adriananglin

    1 Apr 2025

    15 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations